Show HN: Kontext CLI – A Go-built credential broker for AI coding agents

AI coding agents need access to external services like GitHub, Stripe, Linear, and databases, but pasting long-lived API keys into .env files or chat windows creates secret sprawl and makes auditing impossible.

Kontext CLI lets a project declare the credentials it needs in a .env.kontext file.

• GITHUB_TOKEN={{kontext:github}}
• STRIPE_KEY={{kontext:stripe}}
• LINEAR_TOKEN={{kontext:linear}}

You run it with something like kontext start --agent claude, and the CLI authenticates the user via OIDC. For services that support OAuth, it then issues short-lived access tokens via RFC 8693 token exchange; for services that require a static API key, the backend injects it directly into the agent's runtime environment.

The key point is that credentials are never stored on disk and only exist in memory for the duration of the session. The agent never receives the actual secrets directly—instead it operates with session-scoped permissions based on refresh tokens and API keys held by the backend.

This structure resembles a kind of STS (Security Token Service), but differs in that the backend continues to hold the long-lived upstream secrets. This makes it possible to:

• Track who spun up which agent
• Audit what the agent accessed
• Control permissions on a per-session basis
• Reduce the burden of rotating credentials later

All tool calls are also streamed, keeping a record of what the agent attempted, what was allowed, and who performed it.